Skip to main content

Modulys Gp Firmware CVE-2023-41084

CRITICAL
Reliance on Cookies without Validation and Integrity Checking (CWE-565)
2023-09-18 ics-cert@hq.dhs.gov
Information Disclosure Modulys Gp Firmware
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 18, 2023 - 20:15 nvd
CRITICAL 9.8

DescriptionNVD

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.

AnalysisAI

Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-565. Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device. Affected products include: Socomec Modulys Gp Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Modulys Gp Firmware

View all
CVE-2023-39446 HIGH
8.8 Sep 18

Thanks to the weaknesses that the web application has at the user management level, an attacker could obtain the informa
CVE-2023-40221 HIGH
8.8 Sep 18

The absence of filters when loading some sections in the web application of the vulnerable device allows potential attac
CVE-2023-39452 HIGH
7.5 Sep 18

The web application that owns the device clearly stores the credentials within the user management section. Rated high s
CVE-2023-41965 HIGH
7.5 Sep 18

Sending some requests in the web application of the vulnerable device allows information to be obtained due to the lack

CVE-2023-38255 MEDIUM
6.1 Sep 18

A potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) w
CVE-2023-38582 MEDIUM
5.4 Sep 18

Persistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker t

Same weakness CWE-565 – Reliance on Cookies without Validation and Integrity Checking

View all
CVE-2026-0257 HIGH POC
7.8
CVE-2022-50926 CRITICAL POC
9.8
CVE-2025-65212 CRITICAL POC
9.8
CVE-2023-35885 CRITICAL POC
9.8
CVE-2022-38297 CRITICAL POC
9.8
CVE-2017-6896 HIGH POC
8.8
CVE-2024-55211 HIGH POC
8.4
CVE-2018-19224 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-41084 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy